fix: fix native tokens disapearing cp-13.35.0

[salimtb]

Description

core PR: MetaMask/core#9063

Changelog

CHANGELOG entry: fix native tokens disapearing

Related issues

Fixes:

Manual testing steps

1. Go to this page...

Screenshots/Recordings

Before

bug.mov

After

fix.mov

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Extension Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Touches asset balance/metadata merge logic on every RPC balance refresh; wrong behavior could hide tokens or stale metadata, but scope is a targeted upstream fix with LavaMoat lockfile alignment.

Overview
Patches @metamask/assets-controller@8.3.2 (via Yarn) and pins the extension to that patched build instead of 8.3.1, backporting core#9063.

The patch changes RpcDataSource so balance polls no longer push existing asset metadata back into the pipeline. Native assets only get a minimal chain stub when state has no valid decimals yet; ERC-20 and natives that already have good metadata are omitted from the RPC assetsInfo payload so repeated polls do not overwrite richer entries (e.g. from Accounts API) or drop native tokens from the UI. Decimals for display stay available through existing state via pickValidDecimals.

LavaMoat policy keys are updated to reflect the nested dependency path change (bridge-status-controller → keyring-controller instead of via assets-controller).

^{Reviewed by Cursor Bugbot for commit 27ed9aa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[Prithpal-Sooriya]

Nice work, happy to validate this tomorrow morning

[metamaskbotv2]

Builds ready [9e58625]

• ⚠️ Make sure the build is safe before downloading and running this build.
  • Please do not use these builds with accounts that contain significant real money.
  • Beware the security risks of cache poisoning.
• Webpack builds: chrome, firefox
• Webpack builds (beta): chrome, firefox
• Webpack builds (flask): chrome, firefox
• Webpack builds (test): chrome, firefox
• Webpack builds (test-flask): chrome, firefox
• bundle size: Bundle Size Stats
• bundle analyzer: Bundle Analyzer
• interaction-benchmark: Interaction Stats
• storybook: Storybook
• typescript migration: Dashboard
• all artifacts

Deprecated Browserify fallback builds

• Browserify builds: chrome, firefox
• Browserify builds (beta): chrome, firefox
• Browserify builds (flask): chrome, firefox
• Browserify builds (test): chrome, firefox
• Browserify builds (test-flask): chrome, firefox

⚡ Performance Benchmarks (Total: 🟢 22 pass · 🟡 1 warn · 🔴 0 fail)

Baseline (latest main): bfe479c | Date: 6/9/2026 | Pipeline: 27232148877 | Baseline logs

Interaction Benchmarks · Samples: 5

Benchmark	chrome-webpack	firefox-webpack
loadNewAccount [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
confirmTx [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
bridgeUserActions [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ loadNewAccount/load_new_account: -55%
• ↓ loadNewAccount/total: -55%
• ↑ loadNewAccount/inp: +10%
• ↑ confirmTx/inp: +11%
• ↓ bridgeUserActions/bridge_load_page: -56%
• ↓ bridgeUserActions/bridge_load_asset_picker: -45%
• ↓ bridgeUserActions/bridge_search_token: -23%
• ↑ bridgeUserActions/longTaskTotalDuration: +16%
• ↑ bridgeUserActions/longTaskMaxDuration: +16%
• ↑ bridgeUserActions/tbt: +61%
• ↓ bridgeUserActions/total: -34%
• ↑ bridgeUserActions/inp: +22%

Startup Benchmarks · Samples: 100

Benchmark	chrome-webpack
startupStandardHome [Sentry log · main/release]	🟢 [CI log]
startupPowerUserHome [Sentry log · main/release]	🟡 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ startupStandardHome/uiStartup: -16%
• ↓ startupStandardHome/load: -18%
• ↓ startupStandardHome/domContentLoaded: -18%
• ↓ startupStandardHome/domInteractive: -29%
• ↓ startupStandardHome/loadScripts: -18%
• ↓ startupStandardHome/setupStore: -12%
• ↓ startupStandardHome/numNetworkReqs: -47%
• ↓ startupStandardHome/inp: -10%
• ↓ startupPowerUserHome/uiStartup: -27%
• ↓ startupPowerUserHome/load: -13%
• ↓ startupPowerUserHome/domContentLoaded: -13%
• ↓ startupPowerUserHome/domInteractive: -33%
• ↓ startupPowerUserHome/firstPaint: -21%
• ↓ startupPowerUserHome/backgroundConnect: -52%
• ↑ startupPowerUserHome/firstReactRender: +12%
• ↓ startupPowerUserHome/loadScripts: -13%
• ↓ startupPowerUserHome/numNetworkReqs: -69%
• ↓ startupPowerUserHome/inp: -14%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

• 🟡 startupPowerUserHome/INP: p75 496ms

User Journey Benchmarks · Samples: 5 · mock API

Benchmark	chrome-webpack	firefox-webpack
onboardingImportWallet [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
onboardingNewWallet [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
assetDetails [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
solanaAssetDetails [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
importSrpHome [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
sendTransactions [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]
swap [Sentry log · main/release]	🟢 [CI log]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↓ onboardingImportWallet/srpButtonToSrpForm: -50%
• ↑ onboardingImportWallet/pwFormToMetricsScreen: +140%
• ↓ onboardingImportWallet/metricsToWalletReadyScreen: -30%
• ↓ onboardingImportWallet/doneButtonToHomeScreen: -72%
• ↓ onboardingImportWallet/openAccountMenuToAccountListLoaded: -71%
• ↓ onboardingImportWallet/longTaskCount: -80%
• ↓ onboardingImportWallet/longTaskTotalDuration: -94%
• ↓ onboardingImportWallet/longTaskMaxDuration: -92%
• ↓ onboardingImportWallet/tbt: -99%
• ↓ onboardingImportWallet/total: -70%
• ↓ onboardingNewWallet/srpButtonToPwForm: -69%
• ↑ onboardingNewWallet/createPwToRecoveryScreen: +134%
• ↓ onboardingNewWallet/skipBackupToMetricsScreen: -57%
• ↓ onboardingNewWallet/agreeButtonToOnboardingSuccess: -23%
• ↓ onboardingNewWallet/doneButtonToAssetList: -18%
• ↓ onboardingNewWallet/longTaskCount: -50%
• ↓ onboardingNewWallet/longTaskTotalDuration: -61%
• ↓ onboardingNewWallet/longTaskMaxDuration: -39%
• ↓ onboardingNewWallet/tbt: -79%
• ↓ onboardingNewWallet/total: -17%
• ↓ assetDetails/assetClickToPriceChart: -64%
• ↓ assetDetails/longTaskCount: -100%
• ↓ assetDetails/longTaskTotalDuration: -100%
• ↓ assetDetails/longTaskMaxDuration: -100%
• ↓ assetDetails/tbt: -100%
• ↓ assetDetails/total: -64%
• ↑ assetDetails/inp: +14%
• ↑ assetDetails/fcp: +26%
• ↓ solanaAssetDetails/assetClickToPriceChart: -68%
• ↓ solanaAssetDetails/total: -68%
• ↑ solanaAssetDetails/inp: +23%
• ↑ solanaAssetDetails/fcp: +26%
• ↓ importSrpHome/loginToHomeScreen: -27%
• ↓ importSrpHome/openAccountMenuAfterLogin: -11%
• ↓ importSrpHome/homeAfterImportWithNewWallet: -68%
• ↓ importSrpHome/longTaskCount: -38%
• ↓ importSrpHome/longTaskTotalDuration: -48%
• ↓ importSrpHome/longTaskMaxDuration: -19%
• ↓ importSrpHome/tbt: -51%
• ↓ importSrpHome/total: -62%
• ↓ importSrpHome/inp: -42%
• ↓ importSrpHome/fcp: -10%
• ↓ importSrpHome/cls: -74%
• ↑ sendTransactions/openSendPageFromHome: +17%
• ↓ sendTransactions/selectTokenToSendFormLoaded: -19%
• ↑ sendTransactions/reviewTransactionToConfirmationPage: +152%
• ↑ sendTransactions/longTaskCount: +100%
• ↑ sendTransactions/longTaskTotalDuration: +79%
• ↑ sendTransactions/tbt: +60%
• ↑ sendTransactions/total: +145%
• ↓ sendTransactions/inp: -33%
• ↑ sendTransactions/lcp: +16%

Dapp Page Load Benchmarks · Samples: 100

Benchmark	chrome-webpack
dappPageLoad [Sentry log · main/release]	🟢 [CI log]

📈 Results compared to the previous 5 runs on main

• ↑ dappPageLoad/pageLoadTime: +20%

Bundle size diffs

• background: 58 Bytes (0%)
• ui: 5 Bytes (0%)
• common: 436 Bytes (0%)

[MajorLift]

@metamaskbot update-policies

[mm-token-exchange-service]

Policies updated.
👀 Please review the diff for suspicious new powers.

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.
🧠 Learn how to read policy diffs: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/browserify/experimental/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/browserify/flask/policy.json changes differ from lavamoat/browserify/main/policy.json changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from lavamoat/webpack/mv2/main/policy.json changes
✅ lavamoat/webpack/mv3/beta/policy.json changes match lavamoat/webpack/mv3/main/policy.json changes
✅ lavamoat/webpack/mv3/experimental/policy.json changes match lavamoat/webpack/mv3/main/policy.json changes
✅ lavamoat/webpack/mv3/flask/policy.json changes match lavamoat/webpack/mv3/main/policy.json changes

[mm-token-exchange-service]

✨ Files requiring CODEOWNER review ✨

📜 @MetaMask/policy-reviewers (8 files, +16 -16)

• 📁 lavamoat/
  • 📁 browserify/
    • 📁 beta/
      • 📄 policy.json +2 -2
    • 📁 experimental/
      • 📄 policy.json +2 -2
    • 📁 flask/
      • 📄 policy.json +2 -2
    • 📁 main/
      • 📄 policy.json +2 -2
  • 📁 webpack/
    • 📁 mv2/
      • 📁 beta/
        • 📄 policy.json +2 -2
      • 📁 experimental/
        • 📄 policy.json +2 -2
      • 📁 flask/
        • 📄 policy.json +2 -2
      • 📁 main/
        • 📄 policy.json +2 -2

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.